Project Paused 1/11/22, Tracked Threat Actor Emails in Phishing Kits. CC @PhishKitTracker if you find a #phishingkit , created by @neonprimetime
Joined May 2019
- Tweets830
- Following1
- Followers2.6K
- Likes1.3K
Pinned Tweet
Fellow #phishingkit hunters
I've moving #PhishingKitTracker over to it's own dedicated Twitter Account @PhishKitTracker
CC @PhishKitTracker on twitter if you find a #threatactoremail in #phishingkit
Thanks,
@neonprimetime
xitter.gq/neonprimetime/status/1…
#infosec community
I've recorded the #threatactoremail from each #phishingkit for the last year & started tracking them out on @GitHub to share with you. My hope is this can somehow be used to fight the onslaught of #phishing seen daily
See the list
github.com/neonprimetime/Phi…
PhishingKitTracker retweeted
This isn't goodbye but more of a shift in targeting. If you ever need anything feel free to DM me. I still regularly use your data so thanks for the hard work on the tracker over the last few years!
Hello fellow #phishingkit #phishing hunters. I have not been able to give the Phishing Kit Tracker (@PhishKitTracker) project the necessary time it requires & therefore have decided at this time to pause the project. Thank you for all your support throughout the years.
1/N
And for those still active and interested in #phishing #phishingkit #threatactoremail I recommend following some of the best phishing kit hunters in the business
@ActorExpose
@JCyberSec_
@actorexpose
@SteveD3
6/N
I will keep fighting the good fight with my @neonprimetime handle and am glad to be a small part in the greater #infosec community!
7/7
PhishingKitTracker retweeted
KIT Intel is a tool for phishing kit research...at scale.
📁 Upload, Analyze, Cluster, and Research phishing kits like never before.
PhishingKitTracker retweeted
So you want to learn about phishing kits 🧑🎓
🧵 In this thread I will highlight threat hunting skills and IoCs within phishing kits to look for ⤵️
Retweets are appreciated ♻️
🔍Follow me for more #phishing intelligence @Jcybersec_
PhishingKitTracker retweeted
This is a utoxic Office phishing kit.
There should be 2 files on the root -
License.txt
maillist.txt
The kit is complex with heavy obfuscation in place as well
PhishingKitTracker retweeted
Always pivot -
The second email address 'ricadojerry' has been linked to a large number of phishing kits targeting Office, Yahoo, DHL, and Gmail.
Can be seen here in the archived @PhishKitTracker run by @neonprimetime
Linked tweet - xitter.gq/PaulWebSec/status/1117…
PhishingKitTracker retweeted
What you think, why Gmail still does nothing about the 1000s of phished credentials going to skids' Gmail inboxes daily?
A: They dgaf.
B: 3 char agencies of US prefer searching in those inboxes when they want access to somewhere than compromising themselves.
C: A+B.
18%A
6%B
76%C
357 votes • Final results174 unique #threatactoremail added to @PhishKitTracker github since May 2020
100 @gmail (63%)
35 @yandexcom
21 @yahoo
7 @protonmail
somebody with power at those email providers should #takethemdown !
github.com/neonprimetime/Phi…
1/n
Props to all who share #threatactoremail
including ...
@actorexpose
@andpalmier
@aneilan
@cs0sf
@marco_ramilli
@neonprimetime
@phishkittracker
@phishunt_io
@securereload
@sysgoblin
@jouliok
to join the fun cc @PhishKitTracker & include exfil email & url in tweet
2/2
PhishingKitTracker retweeted
here is REAL #phishing many companies received last year
urlscan.io/search/#sharepoin…
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
PhishingKitTracker retweeted
another abused service to watch for is @piktochart for credential #phishing like Canva and Zizera
urlscan.io/search/#create.pi…
sample from a few days ago
hxxps://create.piktochart[.]com/output/51172832-river-city-tax-consulting-llc
urlscan.io/result/de91f2dd-0…
PhishingKitTracker retweeted
did you know survey gizmo is now named @AlchemerHQ ?
It’s still abused for cred #phishing though !
Email Subject: Check #<no> payment
survey.alchemer[.]com/s3/6076800/The-Drainman-Inc-Invoice
urlscan.io/result/befc66c5-2…
